---
typeId: req
recordId: benac-auth-011
fields:
  title: Packages do not receive raw authentication secrets by default
  statement: Packages shall not receive raw passwords, tokens, API keys, private
    keys, session cookies, or other authentication secrets by default. Secret or
    credential use shall be mediated by the Host Station and recorded as an
    effect.
  rationale: Package code should not be able to exfiltrate long-lived credentials
    merely because it can request an authenticated operation.
  verification: Inspect package inputs and host interface calls during an
    authenticated external request and verify that raw secret material is not
    exposed to the package unless explicitly granted by a high-risk policy.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 26
---
